← Retour aux CVEs

CVE-2021-26084

CRITICALCISA KEV

9.8

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie8/30/2021

Derniere modification10/24/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurAtlassian

ProduitConfluence Server and Data Center

Nom vulnerabiliteAtlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Date ajout KEV2021-11-03

Date limite remediation2021-11-17

Utilise dans ransomwareKnown

Produits affectes

atlassian:confluence_data_centeratlassian:confluence_server

Faiblesses (CWE)

CWE-917CWE-917

References

http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html(security@atlassian.com)

https://jira.atlassian.com/browse/CONFSERVER-67940(security@atlassian.com)

http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html(af854a3a-2127-422b-91ae-364da2661108)

https://jira.atlassian.com/browse/CONFSERVER-67940(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26084(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.